Compromising online accounts by cracking voicemail systems Martin - PowerPoint PPT Presentation

Compromising online accounts by cracking voicemail systems Martin Vigo @martin_vigo | martinvigo.com

8 2 1 6 C P C d ” n a e m í r r c t l e d s a í d m a b A A a L “ g n i y a l p e l i h w d e r u t p a C Martin Vigo Product Security Lead From Galicia, Spain Research | Scuba | Gin tonics @martin_vigo - martinvigo.com

History back to ezines

“You can just enter all 2-digit combinations until you get the right one” … “A more sophisticated and fast way to do this is to take advantage of the fact that such machines typically do not read two numbers at a time, and discard them, but just look for the correct sequence” Hacking Telephone Answering Machines by Doctor Pizz and Cybersperm

“Quickly Enter the following string: 123456789876543213579246864297314741933669944885522775395 96372582838491817161511026203040506070809001 (this is the shortest string for entering every possible 2-digit combo.)” Hacking AT&T Answering Machines Quick and Dirty by oleBuzzard

“Defaults For ASPEN Are: (E.G. Box is 888) …. Use Normal Hacking Techniques: ------------------------------- i.e. 1111 | \|/ 9999 1234 4321” A Tutorial of Aspen Voice Mailbox Systems, by Slycath

“There is also the old "change the message" secret to make it say something to the effect of this line accepts all toll charges so you can bill third party calls to that number” Hacking Answering Machines 1990 by Predat0r

Voicemail security in the ‘80s • Default PINs • Common PINs • Bruteforceable PINs • E ffi cient bruteforcing sending multiple PINs at once • The greeting message is an attack vector

Voicemail security today checklist time!

Voicemail security today Default PINs • Common PINs • AT&T • Vodafone • 111111 • Bruteforceable PINs • 4 last digits of client number • T-Mobile • 4 last digits of PUK for CallYa • E ffi cient bruteforcing • Last 4 digits of the phone number by entering multiple • Telekom PINs at once • Sprint • 4 last digits of card number • Last 7 digit of the phone number • The greeting • O2 message is an attack • Verizon vector • 8705 • Last 4 digits of the phone number

Voicemail security today 2012 Research study by Data Genetics https://www.datagenetics.com/blog/september32012 Default PINs Common PINs • Bruteforceable PINs • E ffi cient bruteforcing by entering multiple PINs at once • The greeting message is an attack vector

Voicemail security today Default PINs • Vodafone Common PINs • AT&T • 4 to 10 digits Bruteforceable PINs • 4 to 7 digits • T-Mobile • E ffi cient bruteforcing • Telekom • 4 to 7 digits by entering multiple PINs at once • Sprint • 4 to 10 digits • 4 to 10 digits • The greeting • O2 message is an attack • Verizon vector • 4 to 10 digits • 4 to 6 digits

Voicemail security today Default PINs Common PINs • Supports multiple pins at a time Bruteforceable PINs E ffi cient bruteforcing • 0000#1111#2222# by entering multiple PINs at once • Without waiting for prompt • The greeting • or error messages message is an attack vector

voicemailcracker.py bruteforcing voicemails fast, cheap, easy, e ffi ciently and undetected

voicemailcracker.py • Fast • Easy • Fully automated • Uses Twilio’s APIs to make hundreds of calls at a time • Configured with specific payloads for major carriers • Cheap • E ffi cient • Entire 4 digits keyspace for $40 • Optimizes bruteforcing • A 50% chance of correctly guessing a 4 digit PIN for $5 • Tries multiple PINs in the same call • Check 1000 phone numbers for • Uses existing research to prioritize default default PIN for $13 PINs, common PINs, patterns, etc.

Undetected

Straight to voicemail • Use backdoor voicemail • Multiple calls at the same time • It’s how slydial service works in reality numbers • Call when phone is o ffl ine • No need to call the victim! • OSINT • Airplane, movie theater, remote trip, Do Not Disturb • Query HLR database AT&T: 408-307-5049 Vodafone: XXX-55-XXXXXXXX • Online services like realphonevalidation.com Verizon: 301-802-6245 Telekom: XXX-13-XXXXXXXX • Class 0 SMS T-Mobile: 805-637-7243 O2: XXX-33-XXXXXXXX Sprint: 513-225-6245 • Reports back if it was displayed

voicemailcracker.py • Fast • Easy • Fully automated • Uses Twilio’s APIs to make hundreds • Configured with specific payloads for major carriers of calls at a time • E ffi cient • Cheap • Optimizes bruteforcing • Entire 4 digits keyspace for $40 • Tries multiple PINs in the same call • A 50% chance of correctly guessing a • Uses existing research to prioritize default PINs, common PINs, patterns, etc. 4 digit PIN for $5 • Undetected • Check 1000 phone numbers for • Supports backdoor voicemail numbers default PIN for $13

Bruteforce protections

Different flavors in Germany Vodafone Telekom O2 Blocks the Caller ID from Resets to a 6 digit PIN Connects directly to accessing mailbox and sends it over SMS customer help-line or even leaving messages

Caller IDs are cheap Vodafone Resets to a 6 digit PIN and sends it over SMS Telekom Blocks the Caller ID from accessing mailbox or even leaving messages O2 Connects directly to customer help-line

voicemailcracker.py • Easy • Fast • Fully automated • Uses Twilio’s APIs to make hundreds • Configured with specific payloads for major carriers of calls at a time • E ffi cient • Cheap • Optimizes bruteforcing • Tries multiple PINs in the same call • Entire 4 digits keyspace for $40 • Uses existing research to prioritize default PINs, common PINs, patterns, etc. • A 50% chance of correctly guessing a • Undetected 4 digit PIN for $5 • Supports backdoor voicemail numbers • Bruteforce protection bypass • Check 1000 phone numbers for default PIN for $13 • Supports Caller ID randomization

Demo bruteforcing voicemail systems with voicemailcracker.py

Impact so what?

What happens if you don’t pick up?

Voicemail takes the call and records it!

Attack vector 1. Bruteforce voicemail system, ideally using backdoor numbers 2. Ensure calls go straight to voicemail (call flooding, OSINT, etc.) 3. Start password reset process using “Call me” feature 4. Listen to the recorded message containing the secret code 5. Profit! voicemailcracker.py can do all this automatically

Demo compromising WhatsApp

We done? Not yet…

User interaction based protection Please press any key to hear the code… Please press [ARANDOMKEY] to hear the code… Please enter the code…

Can we beat this recommended protection?

Hint

Another hint Default PINs Common PINs Bruteforceable PINs E ffi cient bruteforcing by entering multiple PINs at once The greeting message is an attack vector

We can record DTMF tones as the greeting message!

Attack vector 1. Bruteforce voicemail system, ideally using backdoor numbers 2. Update greeting message according to the account to be hacked 3. Ensure calls go straight to voicemail (call flooding, OSINT, etc.) 4. Start password reset process using “Call me” feature 5. Listen to the recorded message containing the secret code 6. Profit! voicemailcracker.py can do all this automatically

Demo compromising Paypal

Vulnerable services small subset

Password reset

2FA

Verification

Physical security

Consent

Open source

voicemailautomator.py • No bruteforcing • Limited to 1 carrier • Change greeting message with specially crafted payloads • Retrieve messages containing the secret temp codes Git repo: github.com/martinvigo/voicemailautomator

Recommendations

Still…do I care? if (carriersSetDefaultPins == TRUE) if (testingForDefaultPinsCheapFastUndetectedAutomatable == TRUE) if (updatingGreetingMessageAutomatable == TRUE) if (retrievingNewestMessageAutomatable == TRUE) if (speechToTextTranscription == TRUE) if (accountCompromiseIsAutomatable == TRUE) print “Yes, I should care”

Recommendations for online services • Don’t use automated calls for security purposes • If not possible, detect answering machine and fail • Require user interaction before providing the secret • with the hope that carriers ban DTMF tones from greeting messages

Recommendations for carriers • Ban DTMF tones from greeting messages • No default PIN • Eliminate backdoor voicemail services • Don’t allow common PINs • or at least no access to login • Detect and prevent bruteforce attempts prompt from them • Voicemail disabled by default • Don’t process multiple PINs at once • and can only be activated from the actual phone or online

Recommendations for you • Disable voicemail • or use longest possible, random PIN • Don’t provide phone number to online services unless required • or it’s the only way to get 2FA • use a virtual number to prevent OSINT and SIM swapping • Use 2FA apps only